The vulnerability in Tobit Laboratories AG TeamDavid's Webbox application arises from insufficient validation of the 'cType' URL parameter, which permits injection of HTTP headers by including control characters like '%0a' (newline) or colons. This enables attackers to modify the Content-Type header and inject additional headers such as Location, resulting in an open redirect vulnerability. The issue is present in versions up to and including Rollout 524. There is no known patch or vendor advisory detailing remediation at this time.

Successful exploitation allows an attacker to manipulate HTTP response headers, potentially causing open redirect behavior. This can be used to redirect users to malicious sites, facilitating phishing or other social engineering attacks. The vulnerability does not require privileges or authentication and has a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or filtering on the 'cType' parameter to block control characters such as newlines and colons to mitigate header injection risks.